Re: [PATCH -next v2] unix stream: Fix use-after-free crashes

On Sun, Sep 4, 2011 at 7:44 AM, Yan, Zheng [off-list ref] wrote:

Commit 0856a30409 (Scm: Remove unnecessary pid & credential references
in Unix socket's send and receive path) introduced a use-after-free bug.
It passes the scm reference to the first skb. Skb(s) afterwards may
reference freed data structure because the first skb can be destructed
by the receiver at anytime. The fix is by passing the scm reference to
the very last skb.

s/by passing/bypassing ?

Signed-off-by: Zheng Yan <redacted>
Reported-by: Jiri Slaby <redacted>
---

Tested on i386 against linux-next (next-20110831).

- Sedat -